YOUR INFORMATION

Privacy policy

Preview reviewed 30 September 2026. No final effective date has been set.

Who we are

NEWTON PHYSIQUES LIMITED operates Little Wins, an invitation-only family app. This notice covers the current hosted service and this public website. It does not describe an implemented iOS app. Our public privacy contact is not open yet.

Information you provide

When a family or member account is created, the service receives account identifiers, usernames, names, family membership and credentials. Passwords are stored as salted hashes. Parent and child accounts have different access permissions.

The service receives content and records you enter: appreciation posts, replies, reactions, everyday care entries, chores and completion records, points, rewards, pocket money and spending records, check-ins, plans, personal reflections, focus choices, personal names and parent-only conversations. Optional writing can contain sensitive information about feelings or family life.

Information used to operate the app

The server also stores sessions, invitations and recovery records, activity inbox records, notification preferences, request receipts, security attempt records and family-management audit metadata. These support sign-in, account recovery, delivery of activity, prevention of repeated or unauthorised requests, and family administration.

When browser notifications are enabled, the service stores the browser's push endpoint and subscription keys to deliver notifications through that browser's push provider. Browser notifications are different from the Android app's phone alerts, which are not currently available.

How we use information

We use these records to provide the account and family features you choose, show content to the appropriate family members, maintain chores and money records, save personal writing, recover accounts and operate the service. Little Wins has no advertising or analytics integration. The current service has no payment collection and does not send family writing to an AI service.

Who can see it

Appreciation posts, replies, everyday care, family check-ins and plans are shared with family members. Parents have additional family-management access. Parent-only conversations are accessible to parent accounts in the app.

A personal reflection is accessed through its author's signed-in account and is separate from the shared family journal and shared export. The service operator can access server databases and backups, including personal reflections and parent-only writing. Little Wins does not use end-to-end encryption.

An unlocked device signed into an account may expose that account's content. Signing out is important on a shared device.

Hosting and delivery providers

The current app API and stored service records are hosted on Railway. This public website is hosted on Cloudflare Pages. A browser's push provider processes notification delivery when browser notifications are enabled. The provider depends on the browser; the code supports Google, Mozilla, Apple and Microsoft push endpoints.

The final notice will identify confirmed hosting locations, provider data-handling arrangements, relevant technical logs and any international transfers. Those operational details have not yet been settled.

Device storage and security

The app uses session cookies and local device storage for its operation, including preferences and drafts. A parent can download a shared family export. Drafts are device-local and are not encrypted private storage.

The server code requires HTTPS for non-local deployments, hashes passwords using salted scrypt, restricts access by account and family role, and marks authenticated API responses not to be cached. Browser session cookies use HttpOnly and SameSite controls and are marked Secure for HTTPS. These controls do not remove the operator's ability to access stored records and backups.

This website adds no analytics script, tracking cookie or data-submission form. Hosting services still receive the network requests needed to serve pages.

Retention and deletion

Current account and family records are stored on the service and in server backups. Clearing a personal reflection removes the current saved reflection; earlier backups may retain copies. Deleting an individual post does not currently remove its historical points award reason from the points ledger.

A complete account-deletion request service is not open yet. Retention periods, backup expiry and treatment of shared records after account deletion are not finalised. See the account deletion page for the current status. Account reset and sign-out are not complete account deletion.

Children and family accounts

The current service includes child accounts in invited families, managed through parent accounts. Intended launch ages, supported countries and parent authorisation arrangements are still being established. An invitation alone should not be understood as a verified legal consent process.

Your choices and requests

You can choose whether to write optional check-ins or reflections, manage available notification preferences, and use existing content editing and clearing controls. A shared family export excludes personal reflections and parent-only conversations; it is not a complete personal-data export.

The service's legal grounds, rights-request channel and relevant complaints information will be included in the final notice. Read Privacy choices for the controls currently available.